PaperlayerView exact revision on arXiv

Source-linked AI summary

Abliteration Mitigation via Refusal Aliases

Nathan Truong

arXiv:2608.18093v1cs.CLcs.AIcs.CR

TL;DR

Existing defenses often overlook how easily abliteration’s refusal direction can be extracted, leaving post-training alignment vulnerable to white-box attacks. AMRA obscures that signal with refusal aliases and rank-k weight updates, improving post-abliteration refusal by 14.70 points on Gemma-2-9B while preserving utility better on Llama-3-8B.

  • Problem

    Existing defenses commonly overlook the extractability of the refusal direction, although abliteration can bypass post-training alignment using few contrastive prompts and no additional training.

  • Method

    AMRA obfuscates refusal activations with random aliases through rank-k updates to residual-stream writers while correcting downstream readers to preserve refusal behavior.

  • Results

    AMRA generally achieves the best post-abliteration scores, improving refusal by 2.16 points on Llama-3-8B and 14.70 points on Gemma-2-9B, with architecture-dependent utility costs.

  • Takeaways & Limitations

    Targeting refusal-direction extraction is a viable approach for mitigating weight-space jailbreaking methods.

  • Takeaways & Limitations

    The evaluation uses single attack experiments, and AMRA’s effectiveness and utility cost are architecture-dependent, with negative post-abliteration refusal remaining on Gemma-2-9B.

Abstract

from arXiv · show

Abliteration, the removal of refusal capabilities from large language models by projecting weight matrices orthogonal to an extracted refusal direction, has emerged as a prominent safety concern through its ability to bypass post-training alignment using only a small set of contrastive prompts. We find that existing defenses commonly overlook the cause of abliteration; that is, how easily the refusal direction can be extracted. To hinder this process, we introduce a weight-editing method that obscures the refusal signal by applying rank-$k$ updates to residual stream writer matrices while replacing refusal-inducing activations with random aliases and correcting downstream reader matrices to preserve the model's original behavior. On Llama-3-8B, AMRA improves post-abliteration refusal scores by $2.16$ points over the undefended baseline with less than $0.5$ percentage points of MMLU degradation. On Gemma-2-9B, it improves the post-abliteration refusal by $14.70$ points over the baseline while keeping harmful output rates similar to the baseline, albeit at a greater utility cost.

1 Introduction

AMRA addresses abliteration by obscuring the refusal direction rather than merely strengthening refusal behavior. It uses rank-k weight updates, random refusal aliases, and downstream reader corrections to preserve the model’s original behavior, while targeting pre-release model protection.

  • 1 Introduction: Black-box jailbreaks can compromise aligned language models through adversarial prompt injections, enabling harmful or invalid outputs that threaten safety and legal policies [Mehrotra et al., 2024, Wei et al., 2023, Shi et al., 2024].This motivates continued efforts to align models with human policies and constrain misuse.
  • 1 Introduction: Abliteration exploits a low-dimensional refusal direction by projecting weight matrices orthogonal to an extracted direction, making refusal-direction extraction a central defense gap [Arditi et al., 2024].Existing defenses include activation steering and circuit-level interventions, but do not explicitly address extracting the refusal direction [Lee et al., 2025, Sheng et al., 2026, Zou et al., 2024].
  • 1 Introduction: AMRA obscures the refusal vector by replacing refusal-inducing activations with low-variance random aliases and patching downstream reader matrices to preserve refusal behavior.The method applies rank-k updates to residual-stream writer matrices at causally relevant layers.
  • 1 Introduction: AMRA is intended primarily for language-model developers to secure models before their first weight release.Access to the original unobfuscated model allows an attacker to apply abliteration directly and defeats the protection.

2 Methodology

AMRA obscures extractable refusal directions by replacing refusal-inducing writer activations with random aliases, then patches downstream readers to preserve original behavior. It selects causally relevant layers through refusal-direction ablation and adversarial attack evaluation, while tuning rank and noise to limit utility degradation.

  • Layer Selection: Relevant layers are identified by ablating each layer’s unit-norm refusal direction and measuring adversarial attack success rate with HarmBench [Mazeika et al., 2024].The selected layers form the set L′; abliteration removes refusal capabilities by projecting weights orthogonal to the refusal vector [Arditi et al., 2024].
  • Motivation: Existing abliteration depends on extracting a ubiquitous residual-stream refusal vector, motivating AMRA’s strategy of obscuring the refusal signal rather than merely removing it.Prior work describes refusal-vector extraction as the basis for projecting weight matrices orthogonal to that direction [Vaswani et al., 2023, Arditi et al., 2024, Lai, 2025, Weidmann, 2025].
  • Writer Matrix Patches: AMRA updates relevant residual-stream writer matrices with rank-k edits that map refusal-inducing directions to random, low-variance alias vectors.Candidate refusal directions come from PCA over mean-centered differences between benign and harmful writer activations; the top-k components define the edited subspace.
  • Patch Effects and Limitations: The method’s noise magnitude and edited layer directly control pollution introduced into subsequent residual representations.Rank-k edits are most effective when inputs align with the selected refusal subspace, but slight alignment can spread noise; optimal ε and k_w are intended to limit quality loss.
  • Downstream Weight Patches: Downstream reader matrices receive low-rank corrections that redirect polluted residual-stream inputs toward clean-input outputs while remaining unchanged on orthogonal subspaces.The correction is rank-≤k_r and minimizes the Frobenius-norm discrepancy under the Eckart–Young theorem.

3 Experiments

Experiments evaluate AMRA on Llama-3-8B and Gemma-2-9B against directional ablation and existing defenses, measuring refusal behavior, safety, and utility. AMRA generally achieves the strongest post-abliteration refusal while imposing architecture-dependent utility costs.

  • Experimental Setup: The evaluation uses refusal-direction extraction from 400 harmful and 400 benign prompts, then applies conventional refusal-vector weight orthogonalization as the attack.Utility is measured with Pile bits-per-byte, GSM8K, and MMLU, while defenses are compared against Surgical, CAST, Circuit Breakers, and AlphaSteer.
  • Experimental Setup: Hyperparameters are selected with NSGA-II through Optuna to balance post-attack refusal-rate preservation against utility heuristics including Pile bits-per-byte and MMLU.The search targets Pareto-optimal configurations rather than optimizing refusal robustness alone.
  • Results: AMRA scores 2.16 points above the undefended baseline on Llama-3-8B and 14.70 points above it on Gemma-2-9B after directional ablation.Across both architectures, AMRA is the only defense reported to improve clean refusal behavior, substantially raise post-abliteration refusal, and maintain low HarmBench ASR and LlamaGuard unsafe rates.
  • Utility Results: On Llama-3-8B, AMRA causes marginal utility losses: Pile BPB rises 0.0136, GSM8K falls 1.4 percentage points, and MMLU falls 0.35 percentage points.These losses are comparable to or smaller than those of Circuit Breakers and AlphaSteer, while CAST substantially degrades Llama utility.
  • Utility Results: On Gemma-2-9B, AMRA’s utility trade-off is larger: Pile BPB rises from 0.8124 to 0.9597, GSM8K falls from 0.5620 to 0.3360, and MMLU decreases roughly 4.9 percentage points.The higher writer-update rank kw = 4 selected for Gemma introduces more residual-stream perturbation than Llama’s rank-one configuration.

4 Related Work

Related work spans LLM safety, activation-level alignment, refusal-vector methods, and rank-one model editing. This paper builds on these directions while targeting obfuscation of refusal routing rather than direct knowledge replacement.

  • LLM Safety: LLM safety research emphasizes preventing harmful outputs and enforcing secure deployment as model usage expands [OpenAI et al., 2024, Grattafiori et al., 2024].Inadequate deployment can make misaligned models a security threat by eliciting harmful instructions.
  • LLM Safety: Activation-level alignment exploits linearly separable internal features to locate refusal-related representations and strengthen refusal against jailbreaking.Mechanistic-interpretability studies identify distinct features in activation space [Elhage et al., 2022, Park et al., 2023, Durmus et al., 2024].
  • Refusal Vectors: Refusal-vector work uses contrastive prompts to identify low-dimensional linear directions associated with refusal and alter model behavior [Rimsky et al., 2024, Postmus and Abreu, 2024, Zou et al., 2025].This line of work builds on the observation that refusal can be localized in activation space [Arditi et al., 2024, Wang et al., 2025].
  • Model Editing: Rank-one model editing rewrites language-model information, whereas this work perturbs feed-forward projections to obfuscate refusal routing without directly replacing factual knowledge [Meng et al., 2022, 2023, Ilharco et al., 2023].The edits adjust how refusal features are routed through downstream layers.

5 Limitations and Future Work

AMRA’s evaluation is limited to single attack experiments, leaving its robustness against more sophisticated extraction methods uncertain. Its utility and refusal outcomes are architecture-dependent, with substantially worse trade-offs on Gemma-2-9B than on Llama-3-8B.

  • Limitations: Single attack experiments leave open whether nonlinear probes or iterative searches could bypass AMRA’s obfuscation.The passage identifies these more sophisticated extraction methods as unresolved limitations.
  • Limitations: AMRA’s utility impact is architecture-dependent: it incurs minimal utility loss on Llama-3-8B but substantially degrades GSM8K and Pile BPB on Gemma-2-9B.Gemma-2-9B used higher-rank updates, according to the passage.
  • Limitations: On Gemma-2-9B, the post-abliteration refusal score remains negative despite the reported defense.This model also exhibits the larger utility degradation described in the passage.

6 Conclusion

The paper introduces AMRA, which obfuscates the refusal direction by replacing refusal-inducing activations with random aliases through rank-k updates. It improves post-abliteration refusal on Llama-3-8B and Gemma-2-9B, with a greater utility cost on Gemma-2-9B.

  • 6 Conclusion: AMRA obfuscates the refusal direction by replacing refusal-inducing activations with random aliases through rank-k updates.The method targets extraction of the refusal direction as a strategy for mitigating weight-space jailbreaking.
  • 6 Conclusion: On Llama-3-8B, AMRA greatly improves post-abliteration refusal while preserving utility.
  • 6 Conclusion: On Gemma-2-9B, AMRA substantially fortifies post-abliteration refusal, though at a greater utility cost.
Loading 2608.18093v1…